---
title: "The End of Third"
description: "The post explains how browser phaseouts of third-party cookies can affect Okta authentication patterns and session features. Third-party cookies are issued by other domains and can support cross-site session introspection, federated login-related behavior, and convenience features, but browsers increasingly restrict them because of security and privacy concerns. Most Okta core authentication flows do not require them; however, applications using an Okta session across different top-level domains, customer-hosted sign-in experiences, ADSSO, and certain “remember me” functions may lose session introspection or extension while basic authentication and token return remain possible. The post recommends testing with Chrome’s third-party cookies disabled, using feature flags, and migrating away from these cookies before Google’s stated exemption ends in 2024."
---

# The End of Third

[Okta](https://yomu.fyi/company/okta) · E. Dunham · Feb 29, 2024

**Type:** Explainer

## Summary

The post explains how browser phaseouts of third-party cookies can affect Okta authentication patterns and session features. Third-party cookies are issued by other domains and can support cross-site session introspection, federated login-related behavior, and convenience features, but browsers increasingly restrict them because of security and privacy concerns. Most Okta core authentication flows do not require them; however, applications using an Okta session across different top-level domains, customer-hosted sign-in experiences, ADSSO, and certain “remember me” functions may lose session introspection or extension while basic authentication and token return remain possible. The post recommends testing with Chrome’s third-party cookies disabled, using feature flags, and migrating away from these cookies before Google’s stated exemption ends in 2024.

## Context

The guidance addresses Okta applications that use cookies across domains, including session introspection, customer-hosted sign-in experiences, Agentless Desktop Single Sign-on, and “remember me” features. It notes that Google provided an update to its deprecation effort and that Okta would assess the specific impact on customers.

## Approach / What changed

Test applications with Chrome’s feature flags configured to simulate third-party cookie deprecation, then identify affected deployment patterns and migrate away from third-party cookies. The post also recommends using a custom domain aligned with the application’s top-level domain where applicable, and following the specified CookiesAllowedforURLs steps for ADSSO deployments.

## Takeaways

- Most Okta core authentication flows do not rely on third-party cookies, so users can still authenticate and receive tokens even when some cookie-dependent features stop working.
- Different top-level domains can prevent applications from introspecting or extending an Okta session; hosting the sign-in experience on the same top-level domain avoids that stated impact.
- Remember Last Used Factor, Okta Identity Engine’s “keep me signed in,” and Okta Classic’s “Remember me” can use third-party cookies when domains differ.

## FAQ

### What continues to work when third-party cookies are blocked?

Authentication remains possible, and tokens are still returned because those functions do not rely on cookies. Users may need to re-authenticate more often, and cookie-dependent session features may be affected.

### How can an application test the future browser behavior?

Chrome feature flags can simulate how Okta’s third-party cookies will be treated after the exemption ends. The post recommends testing the application as soon as possible to allow time for testing and unforeseen issues.

### When does hosting the sign-in experience avoid the stated impact?

If the sign-in experience is hosted on the same top-level domain as the application, third-party cookie deprecation will not affect its behavior. A separate top-level domain can break session introspection and extension, although authentication and token return remain possible.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Privacy](https://yomu.fyi/topic/privacy), [Security](https://yomu.fyi/topic/security)

- Source: [Okta](https://developer.okta.com/blog/2024/02/29/third-party-cookies)
- Source URL: https://developer.okta.com/blog/2024/02/29/third-party-cookies
- Ingested by Yomu: 2026-09-17T14:12:49.460Z

[Read original post](https://developer.okta.com/blog/2024/02/29/third-party-cookies)